This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-43961 →

ALPINE-CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context du...

Original description

The description as published by the source.

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.23 vim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0481-r0"}]}]

References

advisory security.alpinelinux.org